Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Patching required for chained authentication bypass and command injection flaws in Barracuda products.
70
Vendor
Barracuda
- Mentions · 7d6
- Mentions · 30d9
- All mentions14
- First seenSep 8, 2026
- Last mentioned5h ago
Timeline
14 articles · newest firstBarracuda discloses authorization bypass and command injection flaws
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
85
Barracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
70
Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
75
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
65
Security leaders report AI and identity threats straining cybersecurity teams
67% of security leaders say their teams struggle to meet business needs due to AI risks and identity-based attacks.
40
Buyer’s guide ranks 10 email encryption services
Virtru leads the editorial scores, followed by Microsoft Purview Message Encryption and Proofpoint.
15
Phishing emails are baiting your AI assistant
Phishing emails hide prompt injections that try to make AI inbox assistants endorse fraudulent payment changes.
58
Attackers Hide AI Prompt Injections Inside Phishing Emails
Barracuda found phishing emails hiding prompt injections aimed at AI inbox assistants and human recipients.
64
Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers
Barracuda details a phishing campaign using Microsoft Teams OAuth redirects and browser blob URLs to render local fake DocuSign login pages for credential theft.
48
New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.
48
Cybercriminals are building phishing pages that exist only inside victims’ browsers
Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.
55
New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser
Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.
52
The 12 Best Managed Firewall Services, Compared and Priced
GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.
12
Related CVEs
by mentions- Auth bypass in Barracuda Email Security Gateway before 9.4.0.030
- Command Injection in Barracuda Appliance Timezone Field
Appears with
- Microsoftvendor · 5
- Email Security Gatewayproduct · 5
- Barracudaorganization · 5
- Web Application Firewallproduct · 4
- DocuSignvendor · 4
- Web Security Gatewayproduct · 4
- Load Balancer Application Delivery Controllerproduct · 4
- Message Archiverproduct · 4
- WAF Control Centerproduct · 4
- Microsoft Teamsproduct · 3
- DocuSignproduct · 2
- Trustwavevendor · 1
- Proofpointvendor · 1
- FortiGateproduct · 1
- Mimecastvendor · 1
- Cybereasonvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.